Elements of Ecommerce Data Encryption

JVM — Thu, 13 Aug 2009 07:24:00 GMT

Securing Ecommerce database information is crucial for service providers and storefront hosts in an effort at preventing hacking and ensuring transparent data transfer. For Ecommerce provider ShopVisible, it is both optimal and advantageous to utilize TDE or Transparent Data Encryption. While processes such as these are blossoming continuously, it seems noteworthy to briefly hit upon past versions of the SQL server as well to better illustrate how Ecommerce protection functions have emerged and where the gaps still exist for things like PCI compliance.

SQL 2000: This version carries with it little to no encryption capability; code developers must create unique code for client applications to ensure data encryption.

SQL 2005: Here Microsoft procured a new encryption feature at the column level (or cell level) for sensitive data. In this case development applications encrypt the data at the database level, however, some degree of architectural tweaking is still needed internally to modify the process and to work with the 2005 version.

SQL 2008: This is where TDE comes into play and for companies like ShopVisible, if client database files were to become corrupted or stolen, Microsoft now has implemented new heightened levels of encryption protection in the Enterprise edition.

While the protective features of Transparent Data Encryption can become quite granular, there are several main features to highlight with regards to the ShopVisible Ecommerce platform.

    -merchant files and related data stored in the database are encrypted with real time IO encryption tools thereby ensuring that in order to restore the database, the user must possess the original encryption certificate and the master key

    -database level encryption occurs so the users utilize minimal resources for data retention and protection whereas in the past this was an arduously layered process

    -when working with the SQL 2008 version, there is no need for recoding or reconfiguring encryption applications

    -ease of implementation…

    -if in your Ecommerce ecosystem, processes such as database mirroring or log shipping occur naturally, the mutual correspondence between the two databases will be encrypted each and every time log transactions are sent

Upon the enabling (or disabling) of TDE, databases are marked as being encrypted and the server will commence a background thread often deemed an “encryption scan” which will then scan and encrypt all database files. Upon completion, all database files on disk become encrypted as will log files written to disk. At the page level database encryption of files is performed then encrypting the pages before they are ever written to disk and decrypted for memory storage. Utilizing TDE will not increase the database encryption size however.

Microsoft openly states that when enabling TDE, it is imperative for the user to back up both the certificate and private key related to it. If either of these are lost and not backed up in an appropriate manner database entry will not be possible. Even in the case that TDE is no longer being used in the Ecommerce data transfer process, the encrypting certificate should be held by the developer or technical lead so that other related process can be turned on and off…

ShopVisible is an Atlanta, GA based Ecommerce solution provider intent on security, scalability and reliability.

ShopVisible, LLC Blog RSS Feed

Elements of Ecommerce Data Encryption